IAM Access Analyzer for GistPin AWS accounts to identify resources shared with external principals.
IAM Access Analyzer continuously monitors AWS resources for access from outside the account. It identifies resources such as S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, and Secrets Manager secrets that are shared with external principals.
The analyzer is deployed via Terraform in infrastructure/terraform/iam-analyzer.tf and uses the ACCOUNT zone type to analyze access within the current account.
| Resource | Type | Purpose |
|---|---|---|
aws_accessanalyzer_analyzer.account |
ACCOUNT | Per-account access analysis |
aws_accessanalyzer_archive_rule.ignore_aws_service |
Archive Rule | Ignores AWS service roles |
aws_accessanalyzer_archive_rule.ignore_service_linked |
Archive Rule | Ignores service-linked roles |
Findings are published to CloudWatch Events and forwarded to SNS. Alerting rules in infrastructure/monitoring/iam-alerts.yml define severity levels:
| Alert | Severity | Threshold |
|---|---|---|
| IAMUnusedAccess | warning | > 0 findings |
| IAMExternalAccess | critical | > 0 findings |
| IAMCrossAccountAccess | high | > 0 findings |
| IAMAnalyzerHighSeverity | critical | > 0 findings |
| IAMAnalyzerActiveFindings | warning | > 10 active |
- Review each finding via the AWS Console or CLI
- Determine if the external access is intentional
- If unintentional, remove the external principal from the resource policy
- Update archive rules to suppress known-good findings
- Document the exception in the finding archive